Merge branch 'master' into VED-80-id-sync-sqs

Author: JamesW1-NHS

.github/dependabot.yml

@@ -71,7 +71,6 @@ updates:
     directories:
       - "/grafana/non-prod/terraform"
       - "/infra"
-      - "/mesh-infra"
       - "/terraform"
       - "/terraform_aws_backup/**"
     schedule:

README.md

@@ -45,7 +45,6 @@ See https://nhsd-confluence.digital.nhs.uk/display/APM/Glossary.
 | `terraform_old`        | Old tf code used to create INT to mimic prod. |
 | `terraform_sandbox`    | Sandbox environment for testing infrastructure changes. |
 | `terraform_aws_backup` | Streamlined backup processing with AWS. |
-| `mesh-infra`           | Infrastructure setup for Imms batch MESH integration. |
 | `proxies`              | Apigee API proxy definitions. |
 ---
 

infra/.terraform.lock.hcl

@@ -37,14 +37,23 @@ resource "aws_security_group" "lambda_redis_sg" {
     protocol  = "-1"
     self      = true
   }
+
+  egress {
+    description = "HTTPS outbound for PDS callout"
+    cidr_blocks = ["0.0.0.0/0"]
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    self        = false
+  }
 }
 
 resource "aws_vpc_endpoint" "sqs_endpoint" {
   vpc_id            = aws_vpc.default.id
   service_name      = "com.amazonaws.${var.aws_region}.sqs"
   vpc_endpoint_type = "Interface"
 
-  subnet_ids          = values(aws_subnet.default_subnets)[*].id
+  subnet_ids          = values(aws_subnet.private)[*].id
   security_group_ids  = [aws_security_group.lambda_redis_sg.id]
   private_dns_enabled = true
 
@@ -74,7 +83,7 @@ resource "aws_vpc_endpoint" "s3_endpoint" {
   vpc_id       = aws_vpc.default.id
   service_name = "com.amazonaws.${var.aws_region}.s3"
 
-  route_table_ids = [aws_route_table.default.id]
+  route_table_ids = [aws_route_table.private.id]
 
   policy = jsonencode({
     Version = "2012-10-17",
@@ -105,7 +114,7 @@ resource "aws_vpc_endpoint" "kinesis_endpoint" {
   service_name      = "com.amazonaws.${var.aws_region}.kinesis-firehose"
   vpc_endpoint_type = "Interface"
 
-  subnet_ids          = values(aws_subnet.default_subnets)[*].id
+  subnet_ids          = values(aws_subnet.private)[*].id
   security_group_ids  = [aws_security_group.lambda_redis_sg.id]
   private_dns_enabled = true
 
@@ -135,7 +144,7 @@ resource "aws_vpc_endpoint" "dynamodb" {
   vpc_id       = aws_vpc.default.id
   service_name = "com.amazonaws.${var.aws_region}.dynamodb"
 
-  route_table_ids = [aws_route_table.default.id]
+  route_table_ids = [aws_route_table.private.id]
 
   tags = {
     Name = "immunisation-dynamo-endpoint"
@@ -147,7 +156,7 @@ resource "aws_vpc_endpoint" "ecr_api" {
   service_name      = "com.amazonaws.${var.aws_region}.ecr.api"
   vpc_endpoint_type = "Interface"
 
-  subnet_ids          = values(aws_subnet.default_subnets)[*].id
+  subnet_ids          = values(aws_subnet.private)[*].id
   security_group_ids  = [aws_security_group.lambda_redis_sg.id]
   private_dns_enabled = true
   tags = {
@@ -160,7 +169,7 @@ resource "aws_vpc_endpoint" "ecr_dkr" {
   service_name      = "com.amazonaws.${var.aws_region}.ecr.dkr"
   vpc_endpoint_type = "Interface"
 
-  subnet_ids          = values(aws_subnet.default_subnets)[*].id
+  subnet_ids          = values(aws_subnet.private)[*].id
   security_group_ids  = [aws_security_group.lambda_redis_sg.id]
   private_dns_enabled = true
   tags = {
@@ -173,7 +182,7 @@ resource "aws_vpc_endpoint" "cloud_watch" {
   service_name      = "com.amazonaws.${var.aws_region}.logs"
   vpc_endpoint_type = "Interface"
 
-  subnet_ids          = values(aws_subnet.default_subnets)[*].id
+  subnet_ids          = values(aws_subnet.private)[*].id
   security_group_ids  = [aws_security_group.lambda_redis_sg.id]
   private_dns_enabled = true
   tags = {
@@ -187,7 +196,7 @@ resource "aws_vpc_endpoint" "kinesis_stream_endpoint" {
   service_name      = "com.amazonaws.${var.aws_region}.kinesis-streams"
   vpc_endpoint_type = "Interface"
 
-  subnet_ids          = values(aws_subnet.default_subnets)[*].id
+  subnet_ids          = values(aws_subnet.private)[*].id
   security_group_ids  = [aws_security_group.lambda_redis_sg.id]
   private_dns_enabled = true
 
@@ -220,7 +229,7 @@ resource "aws_vpc_endpoint" "kms_endpoint" {
   service_name      = "com.amazonaws.${var.aws_region}.kms"
   vpc_endpoint_type = "Interface"
 
-  subnet_ids          = values(aws_subnet.default_subnets)[*].id
+  subnet_ids          = values(aws_subnet.private)[*].id
   security_group_ids  = [aws_security_group.lambda_redis_sg.id]
   private_dns_enabled = true
 
@@ -255,7 +264,7 @@ resource "aws_vpc_endpoint" "lambda_endpoint" {
   service_name      = "com.amazonaws.${var.aws_region}.lambda"
   vpc_endpoint_type = "Interface"
 
-  subnet_ids          = values(aws_subnet.default_subnets)[*].id
+  subnet_ids          = values(aws_subnet.private)[*].id
   security_group_ids  = [aws_security_group.lambda_redis_sg.id]
   private_dns_enabled = true
   tags = {

infra/endpoints.tf

@@ -7,3 +7,5 @@ dspp_admin_role          = "root"
 environment              = "int"
 parent_route53_zone_name = "int.vds.platform.nhs.uk"
 child_route53_zone_name  = "imms.int.vds.platform.nhs.uk"
+mesh_mailbox_id          = "X26OT303"
+mesh_dlq_mailbox_id      = "X26OT304"

infra/environments/int/variables.tfvars

@@ -7,3 +7,8 @@ dspp_admin_role          = "root"
 environment              = "dev"
 parent_route53_zone_name = "dev.vds.platform.nhs.uk"
 child_route53_zone_name  = "imms.dev.vds.platform.nhs.uk"
+# TODO - null these out once we're using the int account
+# mesh_mailbox_id          = null
+# mesh_dlq_mailbox_id      = null
+mesh_mailbox_id          = "X26OT303"
+mesh_dlq_mailbox_id      = "X26OT304"

infra/environments/non-prod/variables.tfvars

@@ -7,3 +7,5 @@ dspp_admin_role          = "root"
 environment              = "prod"
 parent_route53_zone_name = "prod.vds.platform.nhs.uk"
 child_route53_zone_name  = "imms.prod.vds.platform.nhs.uk"
+mesh_mailbox_id          = "X26HC138"
+mesh_dlq_mailbox_id      = null

infra/environments/prod/variables.tfvars

@@ -0,0 +1,15 @@
+# MESH Client Module - conditionally created based on environment configuration
+module "mesh" {
+  count  = var.mesh_mailbox_id != null ? 1 : 0
+  source = "git::https://github.com/nhsdigital/terraform-aws-mesh-client.git//module?ref=v2.1.5"
+
+  name_prefix                    = "imms-${var.environment}"
+  account_id                     = var.imms_account_id
+  mesh_env                       = var.environment == "prod"? "production" : "integration"
+  subnet_ids                     = toset([])
+  mailbox_ids                    = [var.mesh_mailbox_id]
+
+  compress_threshold             = 1 * 1024 * 1024
+  get_message_max_concurrency    = 10
+  handshake_schedule             = "rate(24 hours)"
+}